\nA new feature of SQL Server 2005 that has been fairly well publicized is the ability, on Windows 2003 operating systems, to enforce password stregth, expiration, and lockout policies on SQL Server logins, as the operating system enforces them on Windows logins. The way that this works is that SQL Server calls NetValidatePasswordPolicy, a Win32 function available on Windows 2003. So if I have a machine policy (either standalone or more likely inherited from a domain policy) that a password must be at least 8 characters long, the following DDL will fail:\n<\/p>\n
\nCREATE LOGIN bob WITH PASSWORD = 'bob'\n<\/p>\n
\nyou need:\n<\/p>\n
\nCREATE LOGIN bob WITH PASSWORD = 'bob000000'\n<\/p>\n
\nHowever, did you realize that password on other secrets will follow policies as well? For example:\n<\/p>\n
\nCREATE APPLICATION ROLE somerolename WITH PASSWORD = 'aaa'
\nCREATE MASTER KEY ENCRYPTION BY PASSWORD = 'aaa'
\nCREATE CERTIFICATE foo WITH SUBJECT = 'foo', ENCRYPTION_PASSWORD = 'aaa'
\nCREATE SYMMETRIC KEY skey WITH ALGORITHM = DES ENCRYPTION BY PASSWORD = 'aaa'\n<\/p>\n
\nwill all fail for the same policy reasons. The lone straggler, at least as of Dec CTP is ASYMMETRIC KEY. This works…\n<\/p>\n
\nCREATE ASYMMETRIC KEY akey WITH ALGORITHM = RSA_512
\n ENCRYPTION BY PASSWORD = 'a'<\/p>\n","protected":false},"excerpt":{"rendered":"
A new feature of SQL Server 2005 that has been fairly well publicized is the ability, on Windows 2003 operating systems, to enforce password stregth, expiration, and lockout policies on SQL Server logins, as the operating system enforces them on Windows logins. The way that this works is that SQL Server calls NetValidatePasswordPolicy, a Win32 […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,28],"tags":[],"class_list":["post-973","post","type-post","status-publish","format-standard","hentry","category-security","category-sql-server-2005"],"yoast_head":"\n